healer | eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe
Size

530KB
MD5

605144475b405341269e44db1425e084
SHA1

ac444571b2910f6ea084ba687810e6612694e992
SHA256

eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1
SHA512

a1a330fa472b50e53fa3349989f73ab835ed1b94b4be9b78565b158f643582b8e55c3afad1c8578e0a1f7264aeff43056f39ef7f16ddfc34496ddf0f2a8856ff
SSDEEP

12288:RMrwy90oIsNOWKrIu4f5KXa/dmmjjs85Rm/8e:VyDO9ILA+mmXs85RQ8e

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c89-12.dat	healer
behavioral1/memory/1368-15-0x0000000000060000-0x000000000006A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr606671.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr606671.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr606671.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr606671.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr606671.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr606671.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 35 IoCs

resource	yara_rule
behavioral1/memory/1928-22-0x00000000024A0000-0x00000000024E6000-memory.dmp	family_redline
behavioral1/memory/1928-24-0x0000000002690000-0x00000000026D4000-memory.dmp	family_redline
behavioral1/memory/1928-34-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-36-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-86-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-84-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-82-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-80-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-78-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-76-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-74-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-70-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-68-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-67-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-60-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-58-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-56-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-50-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-48-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-46-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-40-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-38-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-30-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-28-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-88-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-72-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-64-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-62-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-54-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-52-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-44-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-42-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-32-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-26-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline
behavioral1/memory/1928-25-0x0000000002690000-0x00000000026CF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 3 IoCs

pid	Process
1892	ziuS1470.exe
1368	jr606671.exe
1928	ku940940.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr606671.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziuS1470.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ziuS1470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ku940940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	jr606671.exe
1368	jr606671.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	jr606671.exe
Token: SeDebugPrivilege	1928	ku940940.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1892	2368	eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe	84
PID 2368 wrote to memory of 1892	2368	eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe	84
PID 2368 wrote to memory of 1892	2368	eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe	84
PID 1892 wrote to memory of 1368	1892	ziuS1470.exe	85
PID 1892 wrote to memory of 1368	1892	ziuS1470.exe	85
PID 1892 wrote to memory of 1928	1892	ziuS1470.exe	94
PID 1892 wrote to memory of 1928	1892	ziuS1470.exe	94
PID 1892 wrote to memory of 1928	1892	ziuS1470.exe	94

C:\Users\Admin\AppData\Local\Temp\eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe
"C:\Users\Admin\AppData\Local\Temp\eb2796e4883f6f7a587a4e879635e6b913a3353cd73c2368313729e4b906c9e1.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuS1470.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuS1470.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr606671.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr606671.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku940940.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku940940.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziuS1470.exe

Filesize
388KB

MD5
00f703ccc585f8b01a1f449335b914d8

SHA1
fbe1d71fdcdae766949d35e8eb7db2869ef65aa2

SHA256
d9f5e4c465b332535c7af14a836bbbaeef543f9550ea474f6c9db88c4a073050

SHA512
56fcbdb9b91647ad7acb70cfe85f72d10a6e476c95140152ce67f6699a0ce82ed09685c2b8a10d860cfc62284867d83fe622d612127bccc00824dc29cd30ca54

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr606671.exe

Filesize
11KB

MD5
9047f06f90f6bcfc55824596c7d9f6ed

SHA1
f1f3342a87a4435e82123523d1f82c65347ed2b4

SHA256
357f195c3f5dd7b9c25b37254b8163d60a84266b4db5fa0316043316cdf9eefe

SHA512
2dba7866b439eb6084979be042b0c7ab6ce93b783dceb9891a464dbdbff5ed34e69e6d10bb13c74af7919c6e73fad2b393e9c8564ffcbf8ab8ea2dd76c77cdd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku940940.exe

Filesize
434KB

MD5
51c4f4c856585f007f6284976d0b6ebd

SHA1
a06eca9c5f620bd90f78a6151ccbbab655949592

SHA256
c6266b840201c2853733e73f68e83fbfef77b6b8f9cc85043d1bb646cb817904

SHA512
651fd4c40b36cd1b3da947ad239b732131682c78ae07ffc208429e0ea8c94cfc92f26d7a2a1af723b84702b241750429fc469be9f0449de6d9eab03be35a8b90

Download Submit
memory/1368-14-0x00007FFBACE73000-0x00007FFBACE75000-memory.dmp

Filesize
8KB

Download
memory/1368-15-0x0000000000060000-0x000000000006A000-memory.dmp

Filesize
40KB

Download
memory/1368-16-0x00007FFBACE73000-0x00007FFBACE75000-memory.dmp

Filesize
8KB

Download
memory/1928-58-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-40-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-24-0x0000000002690000-0x00000000026D4000-memory.dmp

Filesize
272KB

Download
memory/1928-34-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-36-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-86-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-84-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-82-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-80-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-78-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-76-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-74-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-70-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-68-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-67-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-60-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-22-0x00000000024A0000-0x00000000024E6000-memory.dmp

Filesize
280KB

Download
memory/1928-56-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-50-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-48-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-46-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-23-0x0000000004E80000-0x0000000005424000-memory.dmp

Filesize
5.6MB

Download
memory/1928-38-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-30-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-28-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-88-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-72-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-64-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-62-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-54-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-52-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-44-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-42-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-32-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-26-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-25-0x0000000002690000-0x00000000026CF000-memory.dmp

Filesize
252KB

Download
memory/1928-931-0x0000000005430000-0x0000000005A48000-memory.dmp

Filesize
6.1MB

Download
memory/1928-932-0x0000000004CB0000-0x0000000004DBA000-memory.dmp

Filesize
1.0MB

Download
memory/1928-933-0x0000000004DF0000-0x0000000004E02000-memory.dmp

Filesize
72KB

Download
memory/1928-934-0x0000000004E10000-0x0000000004E4C000-memory.dmp

Filesize
240KB

Download
memory/1928-935-0x0000000005B50000-0x0000000005B9C000-memory.dmp

Filesize
304KB

Download